ISO 42001 requirements: what clauses 4 to 10 ask for

What ISO 42001 clauses 4 to 10 ask for before an AI management system can be certified

If a customer questionnaire, contract or regulator now asks for ISO/IEC 42001, the first thing to understand is that clauses 4 to 10 are the mandatory management system requirements, and the organization owns them. Only an independent certification body issues a certificate, and DeployOpen prepares systems and evidence but does not issue reports or certificates. The edition in force is ISO/IEC 42001:2023, published on 18 December 2023. Clauses 4 to 10 cover context and scope (clause 4), leadership, policy and roles (clause 5), planning including AI risk and impact assessment and planning of changes (clause 6), support including competence and documented information (clause 7), operation (clause 8), performance evaluation including internal audit and management review (clause 9), and improvement including corrective action (clause 10). Read the clause structure before reading the Annex A controls, because the controls are inputs to these clauses rather than a substitute for them.

The Annex A controls are not all mandatory. Under clause 6.1.3, the organization writes a statement of applicability that lists the controls it needs and justifies including or excluding each of the 38 Annex A controls. Your first practical step is to confirm which clauses your certification body will audit and which Annex A controls your statement of applicability must address, and to ask your certification body how it expects you to document exclusions. Ask whether any requirement in clauses 4 to 10 is interpreted differently for your sector or for a combined management system.

Which requirement sits in each of clauses 4 to 10

ISO/IEC 42001 sets its management system requirements in clauses 4 to 10, following the harmonized structure shared by other ISO management system standards. Each clause group builds on the one before it, from understanding the organization to fixing nonconformities. The cards below show what each group asks for and what an assessor will look for.

Context and interested parties

Clause 4.1 asks the organization to understand its context, including the internal and external issues that affect how it develops, provides or uses AI systems. Clause 4.2 asks it to identify interested parties, such as customers, regulators, users and affected individuals, and their needs and expectations for AI. Check that the list of issues and parties is written down, dated and reviewed, because every later clause depends on it. An assessor will trace scope and risk decisions back to this record.

Scope and the AI management system

Clause 4.3 requires a documented scope that states which AI activities, products, services, units and locations the AI management system covers, taking into account the context and interested party needs from the previous clauses. Clause 4.4 requires the organization to establish, implement, maintain and continually improve the AI management system itself. Confirm that the scope names the AI systems in play and the organization's role for each, since a boundary drawn too narrowly is a common reason for audit findings.

Leadership, policy and roles

Clause 5 in the harmonized structure sets leadership duties, including top management commitment, an AI policy and assigned roles and responsibilities. The supplied topic facts name clauses 4 to 10 as the management system requirements, so confirm with the clause text which leadership obligations sit in clause 5 and which are covered by Annex A controls. Check that a named executive owns the AI management system and that the policy is approved and communicated.

Planning for AI risk, impact and change

Clause 6.1 covers actions to address AI risks and opportunities, including AI risk assessment, AI risk treatment and AI system impact assessment. Clause 6.2 requires AI objectives and plans to reach them. Clause 6.3 requires planning of changes to the management system, which is specific to AI because models, data and use cases change often. Clause 6.1.3 also requires a statement of applicability justifying each Annex A control. Check that risk and impact outputs feed the objectives and change log.

Support: resources, competence and records

Clause 7.1 asks for the resources the AI management system needs, and 7.2 for competence of the people who affect AI performance. Clause 7.3 covers awareness of the policy and objectives, and 7.4 covers internal and external communication. Clause 7.5 governs documented information: creating, updating and controlling it. Auditors often sample training records and document version histories, so check that each record names an owner, a date and an approval.

Operation, performance and improvement

Clause 8 covers operational planning and control, plus the AI risk assessment, risk treatment and impact assessment carried out in practice. Clause 9 covers monitoring and measurement (9.1), internal audit (9.2) and management review (9.3). Clause 10 covers continual improvement (10.1) and nonconformity and corrective action (10.2). Certification bodies test whether these loops run on a schedule and produce records, so check that each nonconformity has a traceable corrective action and a closure date.

Which clauses are AI-specific and why auditors look hard at them

The clauses most likely to separate a paper program from a working AI management system are the ones with no close equivalent in ISO/IEC 27001. AI system impact assessment appears twice: in clause 6.1.4, where the organization plans how it will assess impacts, and in clause 8.4, where it carries out the assessment for each relevant AI system. The impacts in question fall on individuals, groups and society, not only on the organization's own assets. Clause 8.2 and 8.3 then operate the AI risk assessment and risk treatment planned under clauses 6.1.2 and 6.1.3, and clause 6.1.3 requires the statement of applicability that records which Annex A controls were included or excluded and why. Clause 6.3, planning of changes, requires changes to the AI management system to be made in a planned way, which matters because models, data and use cases change often.

The management system mechanics will feel familiar to anyone who has run ISO/IEC 27001, because both standards use the harmonized structure of clauses 4 to 10. Scope, policy, internal audit, management review and corrective action work much the same way. The difference is content. An auditor will test whether the risk register captures harms such as unfair outcomes, misuse or opaque decisions, not just confidentiality, integrity and availability. Before the first audit, ask who owns each impact assessment, what triggers a new one, and whether the results actually changed a design or deployment decision. Related guidance exists in ISO/IEC 23894:2023 on AI risk management and ISO/IEC 42005:2025 on AI system impact assessment. Read both to shape your method, but confirm the exact requirements against the published standards and your certification body's expectations.

How clauses relate to Annex A and Annex B

Annex A is normative and lists 38 reference control objectives and controls in nine areas: policies related to AI (A.2), internal organization (A.3), resources (A.4), impact assessment (A.5), life cycle (A.6), data (A.7), information for interested parties (A.8), use (A.9), and third parties and customers (A.10). The organization is not required to implement every control. Under clause 6.1.3, it produces a statement of applicability that lists the controls it needs and justifies including or excluding each one. The clauses are not optional, so an excluded Annex A control never removes a clause requirement.

Selection is documented: every one of the 38 controls appears in the statement of applicability with a decision and a reason.
Clause links are explicit: an auditor expects each included control to trace to a risk treatment decision under clause 6.1.3 and to an objective or process under clauses 6 and 8.
Exclusions are tested: auditors check whether a stated exclusion is consistent with the AI risk assessment and impact assessment results.
Owners and evidence are named: each included control should point to an owner, a process and a record that can be sampled.
Changes flow back: a new AI system or supplier change should update the statement of applicability and reopen the affected clause activities.

Before submitting for certification, confirm with your certification body how it samples Annex A controls and which evidence it expects for each included control.

How the certification body tests clauses 4 to 10 in an audit

The certification body reads the management system documents first, then checks readiness, then tests whether clauses 4 to 10 operate in practice, and any gaps move through a formal corrective action loop before a decision is made.

Submit the management system documentation
The organization sends the certification body its documented AI management system, including the scope statement under clause 4.3, the AI policy, the roles and responsibilities, the risk and impact assessment records and the statement of applicability required by clause 6.1.3. The organization owns and signs off these documents, and the certification body does not write them. The step is complete when the auditor confirms the document set is complete enough to begin the review.
Review documents against clauses 4 to 10
The auditor reads the documentation against each requirement in clauses 4 to 10, checking that the context, interested parties, scope, leadership commitment, planning, support, operation, performance evaluation and improvement are defined and internally consistent. Documents that contradict each other, or that cite controls the statement of applicability does not include, are recorded as findings. The output is a documented view of where the system is defined and where it is not.
Complete the stage 1 readiness review
In the stage 1 review, the auditor confirms that the management system is designed to meet the standard and that the organization is ready for a full assessment. This includes checking the scope, the internal audit and management review arrangements under clauses 9.2 and 9.3, and whether the organization has the information it needs to prepare. Any areas that need attention before stage 2 are written down. The step closes with a documented readiness outcome that the organization must address.
Address stage 1 findings before implementation testing
The organization works through the stage 1 findings, updating documents, records and process descriptions where needed. Owners of each finding, and the evidence that the change has been made, should be tracked in the organization's own register. DeployOpen can help prepare evidence for this stage when the scope is agreed in writing, but it cannot close findings on the certification body's behalf. The step is complete when the auditor accepts the responses for the stage 2 plan.
Test implementation in the stage 2 audit
The stage 2 audit tests whether the management system operates as documented. The auditor samples AI systems in scope and asks for records of AI risk assessment and treatment under clauses 6.1.2, 6.1.3, 8.2 and 8.3, impact assessments under clause 8.4, competence records under clause 7.2, documented information controlled under clause 7.5, monitoring results under clause 9.1 and internal audit and management review outputs. Interviews with staff who own these processes are part of the test. The output is a list of conformities and nonconformities.
Raise and track nonconformities
Where the auditor finds a nonconformity, the certification body records it with its basis in the standard and the evidence reviewed. The organization must investigate the cause, decide on a correction, and carry out corrective action under clause 10.2, then provide evidence that the action was effective. The organization owns this loop, and the certification body verifies the response. The step closes when each nonconformity has an accepted corrective action record.
Receive the certification decision
After the nonconformities are resolved, the certification body makes its certification decision based on its own review of the audit evidence. Only the certification body issues the certificate, and DeployOpen does not issue audit reports, attestations or certificates. Organizations should confirm the accreditation status and scope of the certification body with the body itself before the audit begins. The step is complete when the certificate is issued or the decision is withheld with reasons.

What auditors test in internal audit, management review and corrective action

Does an auditor check whether an internal audit programme exists under ISO 42001 clause 9.2?

Yes. The auditor checks that the organization runs internal audits of its AI management system at planned intervals and that the programme covers the whole AIMS, not only the parts that are easy to reach. Expect questions about who plans the programme, how auditors are selected so they do not audit their own work, and how findings are recorded. Evidence usually includes an audit programme document, a schedule, audit plans, checklists or notes, reports, and records showing that findings were passed to the people who own the affected process. Confirm with your certification body how it expects the programme to be scoped, because the depth it tests can differ by organization.

What does a certification body look for in ISO 42001 management review under clause 9.3?

The auditor looks for evidence that top management reviews the AIMS at planned intervals and that the review considers the inputs the standard lists, such as the status of actions from earlier reviews, changes in external and internal issues, performance information, and opportunities for improvement. The auditor then checks that the review produced decisions and actions with owners. Minutes, agendas, input packs and action logs are the usual evidence. A review that only confirms the meeting happened, without recorded decisions, is a common weakness. Ask your certification body for its interpretation of each input before the first review cycle.

How does an auditor test corrective action for AI nonconformities under clause 10.2?

The auditor follows a nonconformity from the point it was raised to the point it was closed. For each one, the organization should show what the nonconformity was, the immediate correction, a root cause analysis, the corrective action chosen, and evidence that the action was implemented and effective. Auditors also check whether a similar nonconformity can recur and whether changes were made to the AIMS as a result. Typical evidence is a nonconformity register, root cause records, action plans with due dates and owners, and follow-up audit results. Records that show closure without any cause analysis are often questioned.

How will an auditor check the statement of applicability under clause 6.1.3?

The auditor checks that the statement of applicability lists every Annex A control, states whether each one is included or excluded, and gives a reason for each decision that ties back to the AI risk assessment and risk treatment. The auditor then compares those reasons with the actual risk treatment plan and with what the organization does in practice. A control marked as implemented should have evidence in the operating records, and an exclusion should have a justification that holds up against the AI systems in scope. Keep version history and approval records, because auditors often ask how the document changed over time.

Can an organization run its own ISO 42001 internal audits, or does it need an outside firm?

The standard does not require an external firm for internal audits. The organization can use its own staff, provided auditors are competent and independent of the process they audit. Many organizations use an outside firm for part of the work because the independence requirement is hard to meet in a small team, or because a fresh view finds gaps that insiders miss. Outside help costs money for days of audit effort, which depends on the number of AI systems, processes and sites in scope. Any firm you hire should be separate from the firm that will certify you, because the certification body must remain independent of the work it audits.

What evidence should be ready before a certification body audits clauses 9 and 10?

Have a complete, dated set of records that shows the management system operating over time, not just documents written for the audit. The core set is the internal audit programme and reports, management review minutes with inputs and decisions, the nonconformity register with root cause and corrective action records, and the change history of the AI policy and statement of applicability. Auditors sample these records, so each entry should be traceable to a real finding or decision. Ask your certification body which records it will sample and for what period, since it sets how much history you need before stage 2.

Can an implementation partner write the internal audit and management review records for us?

An implementation partner can prepare templates, set up the programme, help run a first cycle and organize evidence. It cannot take over the decisions. The organization owns its controls, must perform the audits and reviews, and must make the decisions recorded in the minutes and action logs. Auditors will ask management questions, and staff must be able to explain their own findings. If records look like they were written by someone other than the people who did the work, expect challenges. Agree in writing which parts of the work the partner prepares and which the organization performs.

What must be in place before the stage 1 review

Stage 1 is where the certification body reads your documented AI management system before it schedules the on-site stage 2 audit. The six items below are the documents and records it expects to see, and each one feeds the next, so a gap in scope or policy usually shows up again in risk, the statement of applicability and the audit evidence.

Defined AIMS scope

Clause 4.3 requires you to set the boundary of the AI management system, including which AI systems, products, services, business units and locations it covers, and to justify any exclusions. Check that the scope names each AI system in use or in development, states your role for it, and matches the interested parties and context recorded under clauses 4.1 and 4.2. Ask the executive sponsor to approve the scope in writing. Ownership usually sits with the chief executive or a senior AI governance lead.

AI policy and assigned roles

Clause 5 requires top management to set an AI policy and assign responsibilities. Annex A controls A.2 and A.3 turn this into a documented policy, a review cycle and named accountability for AI systems, including a route for raising concerns. Check that the policy is approved, communicated to staff, and that each role has a named person with an accountable decision right. The policy owner is typically the chief executive or CIO, with a designated AI governance lead running the day-to-day record.

AI risk and impact assessment method

Clauses 6.1.2 and 6.1.4 require a defined method for assessing AI risk and for assessing the impact of AI systems on individuals, groups and society. The method should state criteria, scales, who approves results and how often it is repeated. Check that you have run it on at least one AI system and kept the records. Risk ownership sits with the business owner of each system, while the risk function or compliance lead maintains the method.

Statement of applicability

Clause 6.1.3 requires a statement of applicability that lists the Annex A controls you need, and a justification for including or excluding each of the 38 controls. Check that every control has a decision, that each exclusion has a reason tied to your scope and risk treatment, and that the controls you include point to real evidence. The compliance lead drafts it, and the risk owner and AI governance lead approve it.

Documented information under clause 7.5

Clause 7.5 requires you to create, update and control the documents and records the AIMS depends on, including version control, approval, access and retention. Check that each document has an owner, a version, an approval date and a storage location, and that superseded versions are retained or removed in a controlled way. Records such as impact assessments, design records and event logs should be easy to retrieve. The document owner is usually the compliance lead, with system owners responsible for their own records.

One internal audit and management review

Clauses 9.2 and 9.3 require an internal audit programme and a management review of the AIMS. Before stage 1, run at least one full cycle, covering the policy, scope, risk treatment and records, and keep the audit report, findings, corrective actions and the minutes of the review. Check that findings were closed or have a dated plan, and that top management reviewed the results. The internal audit lead should be independent of the AIMS operation, and the chief executive or CIO chairs the management review.

Who owns clauses 4 to 10 and who can help

The organization certified to ISO/IEC 42001 owns its AI management system. Clauses 4 to 10 ask for decisions that only leadership and accountable staff can make: what the organization is, which AI systems fall in scope, what its AI policy commits to, which AI risks it accepts, what its objectives are, and whether the management system is working. Those decisions must be recorded and traceable, because an auditor will ask who made them and on what basis.

Context and scope (clauses 4.1 to 4.3): Leadership decides which interested parties matter, which AI systems are inside the boundary and what role the organization plays for each system.
Policy and roles (clause 5): Top management approves the AI policy and assigns responsibilities for AI activities, with named owners rather than only team names.
Risk and impact decisions (clauses 6.1 and 8.2 to 8.4): The organization accepts or treats AI risks and signs off impact assessment conclusions. Risk owners must be people with authority to accept residual risk.
Management review (clause 9.3): Top management reviews performance, internal audit results and nonconformities, then decides on improvement actions.
Sign-off on the statement of applicability: The organization justifies each inclusion and exclusion of Annex A controls under clause 6.1.3.

Check that every decision in your management system has a named owner, a date and a record that shows the reasoning.

Questions buyers ask about ISO 42001 clauses 4 to 10

Do we have to implement every Annex A control in ISO 42001?

No. ISO/IEC 42001 does not require every Annex A control to be implemented. Clause 6.1.3 requires a statement of applicability that lists the controls your organization needs and gives a justification for including or excluding each of the 38 Annex A controls. The justification is what an auditor tests. An exclusion is acceptable when it is reasoned from your AI risks, your AI roles and the systems in scope, and it is weak when it is unexplained or contradicts your risk treatment. Your internal team owns the decisions. An implementation partner can help document them, but the organization must be able to show who decided, on what basis, and how the decision is reviewed as AI systems change.

Can we combine ISO 42001 with ISO 27001 in one management system?

Yes, in practice many organizations do this. ISO/IEC 42001 uses the harmonized structure shared by ISO management system standards, with requirements in clauses 4 to 10, which is the same structure used by ISO/IEC 27001. That shared structure means context, leadership, planning, support, operation, performance evaluation and improvement can often be run as one set of processes with one internal audit programme and one management review. The AI-specific parts still need their own content, including AI risk assessment, AI system impact assessment and the AI-specific Annex A controls. Confirm with your certification body how it will audit an integrated system and whether it will issue separate certificates, because that depends on its accreditation scope and procedures.

How much internal effort do clauses 4 to 10 take, and what drives it?

The effort depends mainly on how much governance already exists and how many AI systems are in scope. Organizations that already run an ISO 27001 or similar management system usually reuse policy, document control, internal audit and management review processes, which reduces new work. The largest new effort is typically the AI-specific content: defining the scope and your role for each AI system under clause 4.3, running AI risk assessment and treatment under clauses 6.1.2 and 6.1.3, and carrying out AI system impact assessment under clause 6.1.4 and clause 8.4. Other drivers include the number of interested parties, how often AI systems change (clause 6.3 planning of changes), the number of suppliers, and the state of your existing documented information. Ask any consultant for a breakdown of effort by clause and by role, and ask who on your team will own each part.

Can a consultant or implementation partner issue our ISO 42001 certificate?

No. Only an accredited certification body can issue an ISO 42001 certificate after an audit. ISO does not certify organizations, and accreditation of certification bodies is voluntary. Consultants and implementation partners prepare the management system, documentation, evidence and internal audit readiness, but they cannot issue the certificate or act as the auditor for the same organization. Where a consultant also audits you, that creates an independence problem that a certification body will not accept. Ask any provider to state in writing what it does and does not do, and make sure the certification body you choose is independent of the firm preparing your system. ISO/IEC 42006:2025 sets additional requirements for bodies certifying AI management systems, so ask a certification body how it meets them.

Can we answer a customer AI governance questionnaire before we are certified?

Yes, you can answer a questionnaire before certification, but you cannot claim certification you do not hold. A questionnaire asks for evidence of your practices, and an organization that has implemented clauses 4 to 10 can describe its AI policy, scope, risk assessment, impact assessment, internal audit and management review with real records. Be precise in your wording: say you have implemented a management system aligned with ISO/IEC 42001 only if that is accurate, and say you are pursuing certification only if you have a written plan and a certification body engaged. Customers can ask for the statement of applicability and sample records, so keep them consistent with what you actually run. Review any draft answers with your legal or compliance team before sending them.

Is ISO 42001 certification accredited through the Global ACI arrangement?

Not yet as far as the published scope shows, so confirm this directly with the certification body. Global ACI-FMRA-001 version 3.3 (August 2026) does not list ISO/IEC 42001 as an endorsed sub-scope of the Global ACI recognition arrangement, although ISO/IEC 27001 is listed with ISO/IEC 27006-1. Accreditation of certification bodies is voluntary, so whether a body holds accreditation for ISO/IEC 42001 is a fact you should check with its accreditation body and in its own scope documents. Ask the certification body which accreditation covers ISO/IEC 42001 certificates it would issue to you, how that accreditation is recognized by your customers and regulators, and whether the certificate will be accepted in the contracts or markets that require it.

How DeployOpen prepares clauses 4 to 10 evidence for your audit

DeployOpen works on the management system side of ISO/IEC 42001: the clause 4 to 10 records an assessor will ask to see. We prepare systems, controls and evidence inside your own infrastructure. The organization owns its AI management system, and only an independent certification body issues a certificate.

How we scope

We agree a written scope covering which clause 4 to 10 records we prepare, before any work starts.
The scope names the AI systems, business units and infrastructure that fall inside the AI management system boundary.
Engagements are fixed-scope, with deliverables and timelines agreed in writing; a quote follows from that scope.

How we build

We configure self-hosted open-source platforms in your cloud accounts or data centers to hold AI policy, risk and objective records.
We set up document control so versions, approvals and review dates of clause 7.5 records are traceable.
We prepare internal audit and management review inputs, and test that the records they produce can be retrieved on request.

How we hand over

You receive documented evidence packs mapped to clauses 4 to 10, with the owners and review cadence for each record.
We walk your internal owners through the records so they can answer assessor questions about context, risk and corrective action.
Ownership of the AI management system, its statement of applicability and its decisions stays with your organization.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
We can help you prepare for the certification body's stage 1 and stage 2 reviews, without issuing any audit report or certificate ourselves.
Ask any partner to confirm in writing which records they prepare, which your staff own, and how the certification body stays independent.